What are once-vs-always grants?What are once-vs-always grants?

A grant is a permission, issued by the human seat, for one action class. The taxonomy has three members: `allow_once`, `allow_always`, and `deny`. The runtime stores the first two as distinct records rather than as one flag, and the reason is worth stating plainly: collapsing once into always is the bug that turns a helper into an unattended bot three weeks later.

`allow_once` is consumed. The first commit that uses it spends it, and the same authorisation cannot be presented a second time. It is the right shape for the first time you let a class run itself — you approve one occurrence and see what it produced.

`allow_always` persists, and it has to declare what it covers. An always-grant without a named scope is refused with `grant_scope_unnamed`. A cross-promotion always-grant has to name the partner, the lane and the window as well. The reasoning is that "always" is only meaningful with a boundary attached: the next event is not the event you approved.

Two lifecycle rules matter. A grant can be revoked at any time, by the human who holds it, with no reason required and no delay — and revocation works on once-grants too, since there is nothing left to consume. And a grant dies rather than adapts when the class it covers changes materially: the runtime supersedes it, so a permission given for one definition of a class is never quietly reused for a different one.

The limits are as important as the powers. A grant can never resurrect a class the pack made absent — no grant, always or once, brings back a tool that is not in the toolset. And a grant never beats a member's stop. The member's own row outranks the organiser's permission, in every lane, with no API to clear it.